services:
  wg-easy:
    image: ghcr.io/wg-easy/wg-easy
    container_name: wg-easy
    environment:
      # Your DDNS domain or public home IP address
      - WG_HOST=yiem.cc
      
      #       Using Docker + wgpw to generate password hash
      # wg-password (wgpw) is a script that generates bcrypt password hashes. You can use it with docker:
      # docker run ghcr.io/wg-easy/wg-easy:14 wgpw YOUR_PASSWORD
      # You will see an output similar to this:
      # PASSWORD_HASH='$2b$12$coPqCsPtcFO.Ab99xylBNOW4.Iu7OOA2/ZIboHN6/oyxca3MWo7fW'
      # In this example, the $2b$12$coPqCsPtcFO.Ab99xylBNOW4.Iu7OOA2/ZIboHN6/oyxca3MWo7fW string is your hashed password. 
      # For using it with docker-compose, you need to escape each $ characters by adding another $ before them, or 
      # they will get interpreted as variables. The final password you can use in docker-compose will look like this:
      # $$2b$$12$$coPqCsPtcFO.Ab99xylBNOW4.Iu7OOA2/ZIboHN6/oyxca3MWo7fW

      # create hash password by $linux> docker run ghcr.io/wg-easy/wg-easy:14 wgpw ton@Wireguard_0.0
      - PASSWORD_HASH=$$2a$$12$$IV3ANTxuu3rHfdrd2bL/.eeLCkI5XQ8veJBSmutXlnXmVt9/m1.zi
      - WG_DEFAULT_DNS=1.1.1.1

      - WG_DEVICE=wg0
      # Allows both incoming (-i wg0) and outgoing (-o wg0) forwarding, plus NAT masquerade
      - WG_POST_UP=iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j MASQUERADE
      - WG_POST_DOWN=iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -j MASQUERADE
    volumes:
      - ./etc_wireguard:/etc/wireguard
    network_mode: host
    ports:
      - "1190:51820/udp" # WireGuard VPN port
      - "1191:51821/tcp" # Web UI port
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    restart: unless-stopped